mcov_injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mcov_injector.exe
Size 6.6MB
Sample261006-sdp41s1th1
SHA256 1782bb10ca22b4680c3ec187a1d988467c6b013a75dc9ec9a29e4d8ba6694d5b
MD5 61408856893ce47381c4c04fa4d99c83
SHA1 39a8216cf71bf67ef441396546f25b713443341d
SHA512 1d22dfa838f38b2bf5a8f687acda2de7b64775114a71174c3886fe2d110a9677c0f79110b8982b37c00c0dd551382a6b5872845243b92a1556ac7bf0ab425d42
SSDEEP 49152:DUWPe4umxn0AlSMtYD4fT/Up3OOOpPcO6KXT/eBS5Rrc8ppYUQ/n7n2yCmFCZH:DUWc6ndSKCm7GhOp09KXTqUZisH
TLSH
T1F6668CB1869C9F0EF076B139C2875617A7F1BC1D6761CF8BAAD09DBB481F490F219209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mcov_injector.exe

File Explorer

mcov_injector.exe

.exe 6.6MB

mcov_injector.exe

IMPHASH 53bf90c427cc2bcd2db05825248c6a55
SHA256 1782bb10ca22b4680c3ec187a1d988467c6b013a75dc9ec9a29e4d8ba6694d5b
MD5 61408856893ce47381c4c04fa4d99c83
SHA1 39a8216cf71bf67ef441396546f25b713443341d
SHA512 1d22dfa838f38b2bf5a8f687acda2de7b64775114a71174c3886fe2d110a9677c0f79110b8982b37c00c0dd551382a6b5872845243b92a1556ac7bf0ab425d42
SSDEEP 49152:DUWPe4umxn0AlSMtYD4fT/Up3OOOpPcO6KXT/eBS5Rrc8ppYUQ/n7n2yCmFCZH:DUWc6ndSKCm7GhOp09KXTqUZisH
TLSH
T1F6668CB1869C9F0EF076B139C2875617A7F1BC1D6761CF8BAAD09DBB481F490F219209
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5898596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

MessageBoxW FindWindowW TranslateMessage GetForegroundWindow PeekMessageW DefWindowProcW PostQuitMessage SetForegroundWindow ShowWindow DispatchMessageW UnregisterClassW SetProcessDPIAware LoadCursorA GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard wsprintfW wsprintfA GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows ClientToScreen GetWindowRect GetWindowTextW IsWindowVisible SystemParametersInfoW LoadCursorW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient GetClientRect UpdateWindow GetSystemMetrics KillTimer SetTimer MsgWaitForMultipleObjects IsIconic SetLayeredWindowAttributes DestroyWindow CreateWindowExW RegisterClassExW

shell32

ShellExecuteW CommandLineToArgvW

dwmapi

DwmExtendFrameIntoClientArea

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

kernel32

GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetStdHandle ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx InitializeSListHead GetCurrentProcess GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap RtlLookupFunctionEntry RtlCaptureContext GetCPInfo SetStdHandle LCMapStringEx DecodePointer EncodePointer GetCommandLineW SetEnvironmentVariableW CloseHandle GetLastError CreateMutexW OpenMutexW CreateEventW WaitForMultipleObjects GetCurrentProcessId GetExitCodeProcess CreateProcessW GetTickCount64 LocalFree MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Module32FirstW Module32NextW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW CreateFileW DeleteFileW GetFileAttributesW GetTempFileNameW ReadFile GetTempPathW WaitForSingleObject TerminateProcess GetCurrentThreadId OpenProcess OpenFileMappingW GetModuleFileNameW FormatMessageA QueryFullProcessImageNameW Process32FirstW Process32NextW MapViewOfFile UnmapViewOfFile WriteFile OutputDebugStringA GetLocalTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA RtlUnwind HeapSize WriteConsoleW SetEndOfFile GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW Sleep TryAcquireSRWLockExclusive RtlPcToFileHeader RaiseException GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

582KB

Virtual Size

582KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mcov_injector.exe

d3d11

d3dcompiler_47

user32

shell32

dwmapi

ole32

kernel32

imm32

generic